topic Re: Rex removing a sub string is not working in Splunk Search

Rex removing a sub string is not working?

johnnybillyd — Mon, 21 Nov 2022 12:06:38 GMT

Hi,

Been banging my head on this brick wall for a while so reaching out for some of expertise. Seems pretty straightforward and regex101 says my expression should work, but I am not getting any data returned in the new field.

Original data is:

18 dB, 16 dB, 12 dB, 12 dB, 12 dB, 13 dB, 4 dB, 8 dB, 9 dB, 9 dB
9 dB, 9 dB, 9 dB, 9 dB
9 dB
9 dB, 9 dB, 9 dB, 9 dB, 9 dB
7 dB, 9 dB

I'm trying to remove the space and the text dB after any number. So the results for the 4th event would read as 9, 9, 9, 9, 9 and the 5th event would be 7, 9

My search returns the events, but no values for the new field:

|rex field=Value "\ dB(?<MicGainText>)"
|table Value MicGainText

If anyone could assist, it would be greatly appreciated. Thanks in advance

John

Re: Rex removing a sub string is not working

gcusello — Mon, 21 Nov 2022 07:06:57 GMT

Hi @johnnybillyd,

probably the regex you shared isn't complete, but it should be:

<your_search> | rex field=Value max_match=0 "dB(?<MicGainText>\d+)" | table Value MicGainText

Ciao.

Giuseppe

Re: Rex removing a sub string is not working

johnnybillyd — Mon, 21 Nov 2022 07:33:55 GMT

Hi @gcusello

Thanks for responding.

Unfortunately, that's still not returning any results for the MicGainText field.

Cheers,

John

Re: Rex removing a sub string is not working

gcusello — Mon, 21 Nov 2022 08:06:11 GMT

Hi @johnnybillyd ,

sorry, please try this:

<your_search> | rex field=Value max_match=0 "(?<MicGainText>\d+)\sdB" | table Value MicGainText

that you can test at https://regex101.com/r/y9tTUs/1

Ciao.

Giuseppe

Re: Rex removing a sub string is not working

johnnybillyd — Mon, 21 Nov 2022 09:54:45 GMT

Hi @gcusello

Thank you very much, that is now working!

It is stripping the comma delimiter, and stacking the values in the table, but I think I will be able to sort that out now you have helped me get the basic rex working though.

Thanks again.

Kudos,

Regards,

John